Login Request a demo
High severity · published Apr 14, 2020
CVE-2020-9384
An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account…
8.8
CVSS
1.9%
EPSS
No
On KEV
Description
An Insecure Direct Object Reference (IDOR) vulnerability in the Change Password feature of Subex ROC Partner Settlement 10.5 allows remote authenticated users to achieve account takeover via manipulation of POST parameters. NOTE: This vulnerability may only affect a testing version of the application
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.9% · higher than 80% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RP
Roc Partner Settlement · Subex
10.5 · source: NVD
Affected product
RP
Roc Partner Settlement
Subex
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-9384
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-9384
Exploit
http://packetstormsecurity.com/files/157197/Subex-ROC-Partner-Settlement-10.5-Insecure-Direct-Object-Reference.html
Vendor Advisory
https://www.subex.com/partner-settlement/